Claude, Copied: The Great LLM Heist

In late February 2026, what started as a routine update from Anthropic turned into one of the most striking public allegations in AI’s competitive history. The company announced that three Chinese artificial-intelligence laboratories, DeepSeek, Moonshot AI, and MiniMax, had allegedly created ~24,000 fraudulent accounts to interact with its flagship Claude model, generating more than 16 million conversations for a single purpose: industrial-scale distillation.

To most practitioners, distillation sounds almost benign, a well-established technique where a smaller, cheaper model learns from a larger, more capable one by training on its outputs. Internally, engineers might distill a massive ensemble into an efficient serviceable version, or compress a bloated research prototype into a production-ready module. But when distillation leaves the lab and enters a competitive battlefield, it becomes something more like siphoning: the extraction of proprietary, high-value insights from another lab’s intellectual property, without authorization.

What made the allegations so intense wasn’t just the scale, 24,000 accounts is nothing to sneeze at, but the modus operandi. According to Anthropic’s blog post and associated social announcements, these accounts weren’t casual human users. They were part of orchestrated campaigns that systematically targeted Claude’s most “differentiated capabilities”: agentic reasoning, coding, tool use, and even internal logic chains that hint at how Claude reasons through problems.

From a technical perspective, this isn’t just busy work. Think of Claude as a black-box oracle with layers of learned responses that encode how it handles ambiguity, ethical constraints, logical chains of thought, and interactive problem solving. By repeatedly prompting Claude with variations, and funneling the responses into a dataset, another developer could train a model that approximates Claude’s behavior, effectively shortcutting massive investments in compute, data engineering, and safety alignment. That’s distillation on steroids.

For Anthropic, the concern is two-pronged. First is the commercial angle: a competitor gaining advanced reasoning and coding abilities at a fraction of the time and cost any normal R&D cycle would require. Second is safety. Claude and other frontier models undergo extensive alignment and testing to reduce harmful outputs. But models trained primarily from extracted outputs don’t inherently carry those guardrails, because you can train a network to mimic answers without internalizing why those safeguards exist. Anthropic explicitly warns that distilled models lacking proper safety protocols could pose broader risks if deployed at scale.

Complicating the narrative is geopolitics. Claude isn’t commercially accessible in China due to export controls and regional restrictions, meaning any widespread access through proxy networks or fake accounts was by design, not accident. Anthropic claims that coordinated traffic patterns, shared metadata, and cloud proxy usage tied these campaigns back to the three Chinese AI labs, suggesting an industrial-scale effort rather than casual experimentation.

This episode also quickly drew industry commentary and debate. In some tech circles, observers countered that distillation at scale is simply competitive engineering; after all, large-scale AI training has historically borrowed from publicly available data without explicit consent, sparking its own ethical and legal questions. The line between legitimate model training and unauthorized extraction is not yet clearly drawn in law or industry norms, creating a new frontier of friction in AI development.

To make this feel more grounded in real world dynamics, consider a parallel from enterprise software: in the mid-2010s, business-network provider LinkedIn sued data analytics startup hiQ Labs over large-scale scraping of public user profiles. LinkedIn argued hiQ violated terms of service and posed security problems; hiQ argued the scraped data was publicly available and therefore fair game. After multiple court battles, industry consensus still hasn’t fully defined how far automated data extraction can go, but the case forced platforms to build stronger defenses and courts to clarify aspects of data usage law. Similarly, the Anthropic distillation story is prompting companies to strengthen API controls, behavioral monitoring, and regulatory cooperation on AI exports and safety.

The countermeasures Anthropic is rolling out include advanced telemetry to detect coordinated access patterns, tightened account verification, and sharing “threat indicators” with cloud partners and other AI labs. In a way, this is the security-hardening phase of AI development: where models aren’t just evaluated on accuracy or benchmark performance, but on platform integrity and mission assurance.

This clash, technical, ethical, commercial, and geopolitical, marks a shift in how we think about AI competition. It’s no longer solely about who has the best architecture or the most data, but about who can protect what they build once it’s accessible in the wild.

The AI frontier just got a lot more competitive, and a bit more controversial.

Anthropic has publicly accused three Chinese AI labs, DeepSeek, Moonshot AI, and MiniMax, of using ~24,000 fraudulent accounts to generate more than 16 million interactions with its Claude model via an industrial-scale distillation campaign, extracting advanced reasoning, coding, and tool-use capabilities to train their own systems.

This isn’t just a technical quibble, it hits at the core of AI IP, safety guardrails, export controls, and global competitiveness. Here’s a narrative explaining what distillation really means in practice, why this matters for the industry, and how the AI ecosystem is adapting in real time.

#AI #MachineLearning #LLM #Anthropic #AICompetition #TechPolicy #CyberSecurity #Distillation #DataGovernance